This Privacy Policy explains how Hien Khang Nguyen ("we", "us") processes your personal data when you use Anime Passport (the "Service", animepassport.eu). We process data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
1. Controller
The controller responsible for data processing on this Service is:
Hien Khang Nguyen, Zentmarkweg 39, 60489 Frankfurt am Main, Deutschland.
Email: hienkhangn@gmail.com
2. What data we process
- Account data — email address, username, optional avatar and home country, created when you register. If you sign in via a third-party provider (e.g. Google or Apple), we receive a basic account identifier and your email.
- Passport & activity data— the events you mark as "want to go", "attending" or "attended" (your stamps), and content you submit (such as event suggestions). Your passport and stamps may be shown on your public profile.
- Social data — connections to other users (follows / friends) and any public activity derived from your stamps.
- Technical data — when you access the Service, our hosting provider automatically processes server log data including your IP address, browser type, and time of access, for the purpose of delivering and securing the site.
3. Purposes & legal bases (Art. 6 GDPR)
- Providing the Service (accounts, stamps, passport, social features) — performance of a contract, Art. 6(1)(b).
- Security, abuse prevention and operating the website — our legitimate interest, Art. 6(1)(f).
- Optional email digest(the "Upcoming near you" newsletter) and any future optional analytics/marketing — your consent, Art. 6(1)(a), which you can withdraw at any time (e.g. by turning the digest off in Settings).
4. Cookies & local storage
We use strictly necessary cookies and browser storage to keep you signed in and to remember your preferences (including your cookie choice). These are required for the Service to function and do not require consent. We do not currently use advertising or third-party analytics cookies. Should we introduce them, we will ask for your consent beforehand via our cookie banner.
5. Processors & third parties
We use carefully selected providers who process data on our behalf under data processing agreements (Art. 28 GDPR):
- Supabase — authentication and database hosting (storage of your account and passport data).
- Vercel — website hosting and content delivery (processing of technical/log data).
- CAPTCHA (hCaptcha or Cloudflare Turnstile) — a privacy-friendly bot check on the sign-up / login forms. It does not track you across sites.
- Upstash — rate-limiting infrastructure that helps prevent spam and abuse (processes a hashed request identifier only).
- Resend— sends the optional "Upcoming near you" email digest, and only if you opt in. You can turn it off anytime in Settings.
- DeepL (EU-based) — machine-translates public event content (descriptions, tips) into other site languages. Processed on our servers only; no personal data is sent.
- Ticket, travel & event partners— when you click an outbound "Buy tickets" or booking link, you leave our Service and the respective provider (e.g. ticketing or travel platforms) processes your data under their own privacy policy. We do not currently use any affiliate links and earn no commission from these outbound links. Should we add affiliate links in future, we will disclose this; even then they would remain ordinary links — we do not embed third-party tracking pixels.
- Image sources — event posters and avatars may be loaded from a fixed allow-list of external image hosts.
Where data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.
5a. External connections — full transparency
We keep the site deliberately lean. Beyond the providers above, the app makes no calls to advertising networks, third-party analytics, IP-geolocation services, or social-media trackers. Fonts are self-hosted (no Google Fonts call). A Content-Security-Policy enforces this in your browser: anything not on the list above is blocked.
For our own planning we keep aggregate, anonymous counts in our own database — how many times a page was viewed and what terms are searched. These counts use no cookies and no IP addresses, are not linked to your identity, and never leave our systems. They simply tell us which events and places the community is interested in.
6. Retention & deletion
We retain your account data for as long as your account exists. You can delete your account at any time, which removes your profile, stamps and social connections, except where we are required to retain certain data by law. To request deletion, contact hienkhangn@gmail.com.
7. Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure / "right to be forgotten" (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interests (Art. 21); and
- withdraw consent at any time, with future effect.
You also have the right to lodge a complaint with a supervisory authority (Datenschutz-Aufsichtsbehörde), in particular in the EU member state of your residence.
8. Children
The Service is not directed to children under 16. We do not knowingly process the personal data of children under that age without parental consent.
9. Changes
We may update this policy as the Service evolves. Material changes will be posted here with an updated date.
10. Contact
Hien Khang Nguyen — hienkhangn@gmail.com